A suspected Chinese-speaking hacking crew has spent the past three months chaining together bugs in WordPress, Zyxel network switches, and Ubiquiti gear to steal government data from dozens of organizations worldwide, according to reports published this week by BleepingComputer and The Hacker News. Threat intelligence firm GreyNoise says the campaign has been running since at least June 2026, and it has now pulled the U.S. Cybersecurity and Infrastructure Security Agency (CISA) into an emergency patching order with a Thursday deadline.
The numbers are what make this one stand out from the usual drumbeat of CVE disclosures. GreyNoise says it has confirmed exploitation and data exfiltration from 996 Zyxel GS1900 switches spread across 48 countries, and a separate WordPress-focused attack chain has hit at least 49 organizations in 29 countries. One unnamed Western government agency reportedly had 18,566 records pulled straight out of its backend database, including plaintext passwords and law-enforcement-related information. No formal government attribution has been made public, and researchers have stopped short of naming a specific APT group.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: A Three-Vendor Hacking Campaign Tied to China
The campaign, as described by GreyNoise and picked up by Cybersecurity Dive, isn’t a single exploit against a single product. It’s a rolling operation that has jumped from Ubiquiti network gear in June to a WordPress core vulnerability chain in July to a Zyxel switch flaw in August, each stage aimed at a slightly different class of victim. GreyNoise labels the actor only as “suspected Chinese-speaking,” a phrasing that reflects language artifacts and infrastructure patterns in the tooling rather than confirmed state sponsorship.
What ties the three intrusion sets together is a preference for internet-facing management interfaces and content management systems that sit at the edge of a network, exactly where a lot of government IT shops and small businesses run outdated software because patching requires downtime nobody wants to schedule. That pattern echoes what we saw earlier this year when ransomware crews piled onto an actively exploited VMware vCenter bug before most agencies had finished patching it.
Timeline: From Ubiquiti Devices in June to a CISA Deadline in September
Piecing together the public reporting, the campaign moved in stages. On June 12, 2026, the actor attempted to exploit three Ubiquiti vulnerabilities, tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, to gain remote code execution on exposed devices. Zyxel published its own advisory for the switch flaw that would later be weaponized that same month. By July 20, the group had pivoted to a WordPress attack chain researchers dubbed “wp2shell,” and it started hitting government and small-business sites across dozens of countries.
GreyNoise says it first observed exploitation of the Zyxel flaw on August 17. By September 17, the firm had confirmed exploitation and exfiltration activity against 996 switches, and it published its findings publicly on September 21. CISA responded the next day by adding the Zyxel bug to its Known Exploited Vulnerabilities catalog and, per BleepingComputer, giving federal civilian agencies until September 24 to patch. That’s a three-day window, tight even by the standards of a KEV listing, and it mirrors the compressed timelines CISA has leaned on all year, including the deadline it set for agencies after a wave of VMware exploitation and a separate order tied to a WatchGuard Firebox bug that stayed unpatched on some networks for 265 days.
Inside the WordPress “wp2shell” Exploit Chain
The WordPress side of the campaign centers on two vulnerabilities in WordPress core rather than a third-party plugin, which is notable because it means every unpatched WordPress install carries the exposure, not just sites running a specific add-on. The first, CVE-2026-63030, is a route-confusion flaw in the WordPress REST API’s batch endpoint. The second, CVE-2026-60137, sits in the WP_Query component and affects how the author__not_in parameter is handled, opening the door to SQL injection.
Chained together, researchers say the two bugs let an attacker reach unauthenticated arbitrary code execution without needing valid credentials or a foothold through a vulnerable plugin, which is what separates wp2shell from the usual plugin-of-the-week vulnerability disclosures. Cybersecurity News reports the flaws affected WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2, all of which have since been patched. That’s a relatively narrow patch gap by CMS standards, but WordPress still powers roughly four in ten websites globally, and update adoption on self-hosted government and small-business sites tends to lag well behind the WordPress.org release calendar.
The timing also overlapped with a wave of other WordPress security news this month. Just days after wp2shell activity was confirmed, the WordPress team shipped version 7.1.1 on September 17 to fix a separate bug dubbed “Comment2Shell,” tracked as CVE-2026-93485. Around the same time, security researchers flagged active exploitation of CVE-2026-32475 in the popular Elementor Pro plugin, which attackers used to drop webshells and run arbitrary commands. None of that second wave has been publicly tied to the same Chinese-speaking actor, but it underscores how much attacker attention WordPress infrastructure has drawn this September, a pattern similar to the record 966 flaws Microsoft patched in its own September update.
The Zyxel GS1900 Buffer Overflow, CVE-2026-7273
The Zyxel side of the campaign is arguably the more dangerous half, because it targets networking hardware rather than a website. CVE-2026-7273, rated 8.8 on the CVSS scale, is a stack-based buffer overflow in a CGI program running on Zyxel’s GS1900 Smart Managed Switches. According to Zyxel’s own June 2026 release notes, the flaw spans ten GS1900 models running firmware 2.90(xxxx.1)C0 or earlier, and the advisory describes it as exploitable by an unauthenticated attacker on the local area network who sends a specially crafted HTTP request, triggering arbitrary operating system command execution on the switch itself.
According to The Hacker News, once attackers get code execution on a vulnerable switch, they use TFTP to pull down a custom data-collection script and run it, then exfiltrate the switch’s configuration file, its hashed root-level credentials, and details about the surrounding network. That’s a meaningful haul even without cracking the password hashes: switch configs typically expose VLAN layouts, connected device inventories, and enough topology detail to plan a deeper intrusion into whatever sits behind that switch.
Why a LAN-Only Bug Still Matters
The “LAN-based, unauthenticated attacker” framing in Zyxel’s advisory might read as reassuring at first glance, since it implies the switch’s management interface needs to already be reachable. In practice, a large number of GS1900 units ship with their web management interface exposed to the wider internet, whether through misconfiguration, remote-management features left switched on, or bridged network segments that blur the line between “LAN” and “internet-facing.” That exposure only matters more given how aggressively Zyxel has been growing its network-edge lineup, including the Wi-Fi 8 and 50G PON technology the company unveiled at MWC in January 2026, which points to more Zyxel gear landing at internet-facing chokepoints in the years ahead. GreyNoise’s scan data, spanning 996 compromised devices across 48 countries, suggests plenty of switches already fit that exposed profile.
What the Hackers Stole: 18,566 Records and Root Credentials
The clearest evidence of impact comes from a single Western government organization that GreyNoise says had 18,566 records pulled from a backend SQL database through the WordPress attack chain. The stolen data reportedly included account details, passwords stored in plaintext, personally identifiable information, and records tied to law enforcement and government functions. Neither GreyNoise nor the outlets covering the story have named the specific agency or country involved, and BleepingComputer’s reporting does not confirm whether the victim organization has issued its own breach disclosure yet.
On the Zyxel side, the haul looks different in kind: hashed root credentials, device configuration files, and network topology data pulled from switch memory rather than a database. Taken together, the two data sets give the attacker both the “who” (usernames, passwords, PII from the government database) and the “where” (network maps and device credentials from the switches), which is a combination that maps cleanly onto the kind of long-term espionage access that has defined other reported China-nexus campaigns against government targets in recent years, including past incidents involving driver’s license and DMV record systems.
Who’s Behind the Campaign: Attribution and a Possible AI-Assisted Twist
GreyNoise is the primary named source behind the attribution, and it’s careful about the language it uses. The firm calls the actor a “suspected Chinese-speaking malicious cyber actor,” a label built from infrastructure fingerprints, tooling artifacts, and language cues rather than a formal government attribution. No outlet covering the story, including BleepingComputer’s Sergiu Gatlan, has linked the campaign to a named APT group such as Volt Typhoon or Salt Typhoon, and none of the current reporting establishes that this was directed by a state intelligence service rather than a criminal or quasi-independent group operating out of a Chinese-speaking region.
One detail that has drawn attention: GreyNoise reportedly suspects the actor used a large language model to help build its custom data-collection tooling. If accurate, that would fit a broader trend security researchers have been flagging through 2026, in which attackers use AI coding assistants to speed up development of bespoke exploit and exfiltration scripts rather than relying purely on off-the-shelf frameworks. It’s a smaller-scale echo of the concern raised when researchers demonstrated Google’s Gemini could be steered into breaching real company systems in a controlled test earlier this year.
Government Targets: Which Countries Got Hit
The available reporting names five countries specifically in connection with the Zyxel exploitation: Italy, the United States, Taiwan, France, and South Korea. Those are drawn from GreyNoise’s scan telemetry rather than a confirmed victim list, and the firm’s broader count of 48 countries with compromised switches suggests the public naming is partial. On the WordPress side, the 29-country, 49-organization figure, first reported by GBHackers, comes with even less geographic detail, described only as “mainly government agencies and small businesses.”
The mix of Taiwan alongside NATO and G7-adjacent countries such as the U.S., France, and Italy fits a pattern seen across other network-edge campaigns this year, where a broad opportunistic sweep against thousands of internet-facing devices produces a smaller list of higher-value government targets once attackers sort through what they’ve compromised. It’s a similar dynamic to what CISA flagged when a Citrix NetScaler bug left roughly 22,000 devices exposed earlier this year, only a fraction of which turned into confirmed, targeted intrusions, a scale documented in our earlier report on the Citrix NetScaler bug hitting the CISA KEV catalog.
CISA’s Emergency Order and the September 24 Deadline
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on Monday, September 21, citing evidence of active exploitation, and BleepingComputer reports the agency gave federal civilian executive branch agencies until Thursday, September 24, to apply the fix. Under CISA’s Binding Operational Directive 22-01, that KEV listing carries force for federal agencies specifically, while state, local, and private-sector Zyxel customers are urged, but not compelled, to patch on the same timeline.
A three-day patch window is aggressive, but it’s not unprecedented for CISA this year. The agency gave agencies just three days to patch a VMware vCenter bug once ransomware gangs started weaponizing it, and it separately flagged a WatchGuard Firebox flaw that had already sat unpatched on some networks for 265 days by the time exploitation was confirmed. The gap between those two numbers, three days of official grace versus 265 days of real-world exposure, says more about how patching actually plays out in large organizations than any single directive can fix.
How This Stacks Up Against Other 2026 Edge-Device Campaigns
Compared with other network-edge exploitation stories from this year, the Zyxel-WordPress campaign is notable less for its individual CVSS scores and more for its persistence and breadth. It has run for at least three months across three unrelated vendors without a single high-profile patch cycle shutting it down, since each product line got compromised on its own separate timeline.
| Campaign / Flaw | Vendor | CVSS | Confirmed Scope | Attribution |
|---|---|---|---|---|
| Zyxel GS1900 (CVE-2026-7273) | Zyxel | 8.8 | 996 switches, 48 countries | Suspected Chinese-speaking actor (GreyNoise) |
| WordPress wp2shell (CVE-2026-63030 / CVE-2026-60137) | WordPress core | Not publicly scored | 49 orgs, 29 countries | Suspected Chinese-speaking actor (GreyNoise) |
| VMware vCenter (CVE-2026-59310) | Broadcom/VMware | 9.8 | 361 IPs, 47 countries | Ransomware-affiliated groups |
| WatchGuard Firebox (CVE-2025-14733) | WatchGuard | Not stated in reporting | Added to CISA KEV after 265 days exposed | Ransomware-affiliated groups |
| Citrix NetScaler KEV listing | Citrix | Not stated in reporting | Roughly 22,000 devices exposed | Multiple actors (opportunistic) |
What jumps out from that comparison is that the Zyxel-WordPress operation is one of the few this year that researchers have tied, even tentatively, to a nation-state-adjacent actor rather than a financially motivated ransomware crew. The VMware, WatchGuard, and Citrix incidents all trace back to ransomware-affiliated exploitation once a patch or proof-of-concept leaked, whereas GreyNoise describes the Zyxel and WordPress activity as deliberate, sustained, and aimed specifically at government data rather than opportunistic file encryption for a ransom payout.
Historical Context: China-Nexus Attacks on Network Edge Gear
Targeting network edge devices, the routers, switches, VPN gateways, and firewalls that sit between an organization and the open internet, has been a hallmark of Chinese-nexus espionage operations for several years now, largely because those devices rarely run endpoint detection software and often go unpatched far longer than a laptop or server would. U.S. officials have previously linked separate China-nexus operators to long-running compromises of small office and home office routers used as staging points for further intrusions.
What’s different about the current campaign, based on the public reporting, is the pairing of that classic edge-device playbook with a CMS-layer attack against WordPress core itself, rather than sticking purely to networking hardware. That combination widens the target pool considerably: instead of needing a specific brand of switch or firewall exposed to the internet, the WordPress leg of the campaign can, in principle, reach any of the millions of self-hosted WordPress sites still running an unpatched 6.8.x, 6.9.x, or 7.0.x build.
Market and Industry Impact
For Zyxel, a CISA KEV listing tied to active nation-state-adjacent exploitation is a reputational hit, even though the company had already shipped a fix months before the exploitation was confirmed, and it isn’t an isolated incident in 2026: Zyxel separately disclosed six CVEs affecting its CPE, ONT, router, and extender product lines back in February 2026. Enterprise buyers evaluating switch vendors increasingly weigh how quickly a company discloses and patches flaws, and Zyxel’s June advisory predating the confirmed August exploitation suggests the disclosure process worked as intended, even if patch adoption in the field did not keep pace.
For the WordPress ecosystem, the story adds to a rough stretch of September security news. Between wp2shell, the Comment2Shell fix in version 7.1.1, and the separate Elementor Pro exploitation, WordPress site owners have faced three distinct waves of urgent patch guidance inside a single month. That volume mirrors what enterprise IT teams dealt with when Microsoft shipped a record 966 fixes in its own September Patch Tuesday release, and it reinforces a broader 2026 trend in which attackers are compressing the window between vulnerability disclosure and real-world exploitation across nearly every major platform.
Patch Status: What’s Fixed and What Isn’t
| Component | Vulnerability | Fixed Version | Fix Date | Status for Unpatched Systems |
|---|---|---|---|---|
| WordPress core (wp2shell) | CVE-2026-63030, CVE-2026-60137 | 6.8.6 / 6.9.5 / 7.0.2 | Prior to July 2026 exploitation wave | Actively exploited if unpatched |
| WordPress core (Comment2Shell) | CVE-2026-93485 | 7.1.1 | September 17, 2026 | Separate issue, patch available |
| Elementor Pro plugin | CVE-2026-32475 | Patched release available | Reported mid-September 2026 | Actively exploited in the wild |
| Zyxel GS1900 switches | CVE-2026-7273 | Firmware update per Zyxel advisory | June 2026 | Actively exploited; CISA KEV deadline Sept. 24, 2026 |
What Security Teams and Site Owners Should Do Right Now
For WordPress administrators, the fix is straightforward: confirm the site is running at least version 6.8.6, 6.9.5, 7.0.2, or the newer 7.1.1 release, since any of those closes off the wp2shell chain and the later Comment2Shell bug. Sites running a vulnerable Elementor Pro build need the plugin update applied separately, since a patched WordPress core does not close that hole on its own.
For teams running Zyxel GS1900 switches, the priority is applying the firmware update referenced in Zyxel’s advisory and, just as important, checking whether the switch’s web management interface is reachable from outside the intended LAN segment. Zyxel has kept up a steady firmware cadence across its switch lines this year, including the XS3800 firmware V4.80(ABML.5)C0 it released in April 2026, so it’s worth confirming every switch model on the network, not just the GS1900 line, is running a current build rather than assuming one advisory covers the whole fleet. A quick way to sanity-check exposure from an external vantage point is to scan the management port range from outside the network boundary, similar to the reconnaissance approach covered in our Nmap network scanning walkthrough:
nmap -p 80,443,8000,8080 --open -sV your.public.ip.range/24
# Flag any Zyxel GS1900 web management response reachable from outside the LAN
# Cross-check firmware version against Zyxel's June 2026 GS1900 advisoryBeyond the immediate patches, organizations running either product should review logs from the affected exposure window: mid-July onward for WordPress, and mid-August onward for Zyxel switches, looking for unexpected REST API batch requests, unusual TFTP traffic off a switch, or database queries touching the author__not_in parameter path. Security teams already running vulnerability scanning tools, such as the setup covered in our Nessus Essentials guide, can add both CVE families to their next scheduled scan.
Predictions: Where This Goes From Here
- Expect CISA to expand its KEV catalog with at least one more edge-device or CMS vulnerability tied to this same actor cluster within the next few weeks, following the pattern set by its recent WatchGuard and VMware listings.
- GreyNoise or a peer threat-intel firm is likely to publish a follow-up report naming additional victim countries beyond the five currently confirmed, as more Zyxel customers audit their switch logs against the August 17 exploitation start date.
- WordPress core patch adoption will likely become a bigger talking point among hosting providers, given that wp2shell targeted core code rather than a plugin, removing the usual excuse that “we don’t run risky third-party plugins.”
- Other switch and router vendors with similar CGI-based management interfaces should see increased scrutiny from researchers looking for comparable buffer-overflow patterns, given how cleanly the Zyxel bug was weaponized once exploitation began.
- Formal government attribution, if it comes at all, is unlikely in the near term. GreyNoise’s own framing stops at “suspected Chinese-speaking,” and neither BleepingComputer nor The Hacker News reports any government statement naming a state sponsor as of this writing.
Frequently Asked Questions
What is CVE-2026-7273?
CVE-2026-7273 is a stack-based buffer overflow, rated 8.8 on the CVSS scale, in a CGI program running on Zyxel GS1900 Smart Managed Switches. It lets an unauthenticated attacker on the local network send a crafted HTTP request to execute operating system commands on the switch.
What is the WordPress “wp2shell” vulnerability chain?
Wp2shell refers to the combination of CVE-2026-63030, a WordPress REST API batch-endpoint route-confusion flaw, and CVE-2026-60137, a SQL injection issue in the WP_Query component’s author__not_in parameter. Chained together, they allow unauthenticated arbitrary code execution on WordPress core.
How many devices and organizations were affected?
GreyNoise confirmed exploitation and data exfiltration from 996 Zyxel switches across 48 countries. Separately, the WordPress attack chain has compromised at least 49 organizations across 29 countries, according to researcher reporting cited by Cybersecurity News.
Has China’s government been officially blamed for this campaign?
No. GreyNoise describes the actor only as “suspected Chinese-speaking,” based on tooling and infrastructure characteristics. No outlet covering the story has published a formal state attribution or named a specific APT group.
When do federal agencies need to patch the Zyxel flaw?
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21, 2026, and BleepingComputer reports a patching deadline of September 24, 2026, for federal civilian executive branch agencies.
Which WordPress versions are safe from wp2shell?
WordPress 6.8.6, 6.9.5, and 7.0.2 all contain fixes for the wp2shell chain. WordPress 7.1.1, released September 17, 2026, adds a fix for the separate Comment2Shell vulnerability, CVE-2026-93485.
Is this campaign related to the Elementor Pro exploitation reported the same week?
Not according to current public reporting. The Elementor Pro exploitation, tracked as CVE-2026-32475, has been reported separately from the wp2shell and Zyxel campaign, though both surfaced in the same mid-to-late September window.
What data was actually stolen from government systems?
GreyNoise reported that one Western government organization had 18,566 records taken from a backend SQL database, including account information, plaintext passwords, personally identifiable information, and data tied to law enforcement and government functions. On the Zyxel side, attackers exfiltrated switch configuration files, hashed root credentials, and networking details rather than database records.
